To build an enterprise risk management (ERM) framework, work through three stages: define the scope, roles and risk appetite that govern the framework; identify and assess risks consistently across the organisation; and plan responses, owners and regular reporting to leadership. Recognised references such as ISO 31000 and the COSO ERM framework describe these elements. The hard part is not the diagram; it is making the process part of how decisions are actually made. If you want guided practice, the enterprise risk management course at LSBUK works through each stage with practical tools such as risk registers.
This guide walks through each stage using a fictional company, Northfield Supplies, a UK distributor with 250 staff.
Define scope and accountability
Scope. Decide what the framework covers: the whole organisation, including strategic, operational, financial, compliance, technology and reputational risk. ERM differs from project or departmental risk management because it looks across the organisation and connects risk to strategy.
Accountability. Write down who does what:
| Role | Responsibility at Northfield |
|---|---|
| Board | Sets risk appetite, reviews top risks quarterly |
| Executive team | Owns the enterprise risk register, agrees responses |
| Risk lead (part-time role in finance) | Runs the process, challenges ratings, prepares reports |
| Risk owners | Named managers who own each risk and its actions |
| All staff | Report new risks and incidents |
Risk appetite. Agree, in plain language, how much risk the organisation is willing to take in pursuit of its goals. Northfield's board states a low appetite for health and safety and regulatory risk, and a moderate appetite for commercial risk when entering new markets. Our guide to risk appetite vs risk tolerance explains how to turn statements like these into limits.
Identify and assess risk
Identify. Run short workshops with each department and the executive team. Ask: what could stop us achieving our objectives this year and over three years? Capture each risk as a cause, event and consequence: "Because we rely on one warehouse (cause), a fire or flood (event) would halt deliveries for weeks (consequence)."
Assess. Rate each risk on likelihood and impact using a scale everyone understands, with definitions for each score. Northfield uses a 1 to 5 scale where an impact of 5 means a loss above £1 million or a regulatory breach. Record both the inherent rating (before controls) and the residual rating (with current controls).
Scoring matrices are useful for comparison, but they have limits. Read risk assessment matrices: how to use them and where they fall short before relying on one for high-stakes decisions.
Record. Put every risk in a single enterprise risk register with a named owner. Our risk register example shows the fields that make one useful.
Plan responses and reporting
Respond. For each risk above appetite, choose a response:
- Reduce: add or strengthen controls. Northfield leases a second, smaller warehouse.
- Transfer: insurance or contracts. Northfield reviews its business interruption cover.
- Avoid: stop the activity that creates the risk.
- Accept: consciously, where the risk is within appetite or the cost of action outweighs the benefit.
Every action needs an owner and a date.
Report. Agree a rhythm:
- risk owners update their risks monthly
- the executive team reviews the full register quarterly
- the board sees the top ten risks, changes since last time, and any risk above appetite
- new major risks are escalated immediately
Review the framework itself once a year: is it being used in decisions, or only filled in before meetings?
Enterprise risk management process at a glance
- Set scope, roles and appetite
- Identify risks against objectives
- Assess likelihood and impact, inherent and residual
- Record in one register with named owners
- Respond: reduce, transfer, avoid or accept
- Monitor and report on a fixed rhythm
- Review and improve the framework annually
Where AI risk fits
If your organisation uses AI, treat AI risks (data protection, accuracy, bias, security and accountability) as part of the same framework rather than a separate list. Our AI Risk Management & Security course covers these in depth.
Learning to build a framework
An enterprise risk management course can help you apply these steps to your own organisation with feedback. Ours covers frameworks aligned with ISO 31000 and COSO ERM, risk registers, risk appetite, assessment, mitigation and reporting, live online or in London.
Related reading
- Enterprise risk management subject guide: frameworks, registers, appetite, assessment and the course
- Risk register practice pack: a worked register entry with defined scales
The bottom line
An ERM framework is a set of decisions about scope, roles, appetite, assessment, response and reporting. Keep it simple enough that managers use it, and review whether it is changing decisions.